feat: package lists per role, with a check-and-install script

The lists are derived rather than typed. beastix has 512 explicit packages -
years of experiments among them - so taking that as "what this machine needs"
would be meaningless. curate.sh combines four usage signals, each of which
alone has a blind spot: shell history sees no GUI application, KDE's activity
database sees no chat client, autostart sees only what starts by itself, and
flatpak entries never appear in pacman -Qqe at all. That reduces 512 to 62.

The split follows the data: what beastix and shron both have becomes the base,
the rest of beastix becomes desktop, shron's own becomes server.

base-devel is one entry in the server list rather than its 26 members. It
stopped being a package group in 2022 - "pacman -Sg base-devel" now fails
outright - and is a meta package today. base, grub and linux-lts are dropped
entirely; they arrive with the operating system.

packages.sh never removes anything. Extras are reported and left alone, for
the same reason the BookStack playbook refuses to: on a server, individual
packages carry mail and web services. It avoids process substitution because
/bin/sh is dash on Debian and a POSIX-mode bash on macOS, and this has to run
on both.

Verified on beastix: 62 wanted, 0 missing, 450 extra reported and untouched;
install is a no-op.

The server list is a snapshot from 2026-08-06 and wants re-reading when shron
is reachable again - its login session has since expired.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/arch-server.txt

@@ -0,0 +1,78 @@
+# Packages for the server role, on top of arch-base.txt.
+#
+# Taken from shron's explicit list of 2026-08-06. Re-check it when shron is
+# reachable again - the snapshot was read while a login session still existed,
+# and that session has since expired.
+#
+# base-devel appears as a single entry rather than its 26 members. It stopped
+# being a package group in 2022 and is a meta package now, so pulling in the
+# members individually is both noisier and no longer how it is installed.
+# base, grub and linux-lts are left out entirely: they come with the operating
+# system and nobody installs them from a dotfiles script.
+7zip
+acme.sh
+base-devel
+btop
+caddy
+certbot
+certbot-dns-gandi
+certbot-nginx
+composer
+crowdsec
+crowdsec-firewall-bouncer-iptables
+docker-compose
+dotpac
+endlessh-git
+fail2ban
+ffmpeg
+figlet
+fzf
+gdu
+gitmux
+kitty-shell-integration
+lazydocker
+libappimage
+libpam-google-authenticator
+librsvg
+libxcrypt-compat
+links
+mariadb
+mdadm
+mtools
+mtr
+net-tools
+nextcloud-client
+nginx
+nmon
+ntfysh-bin
+php
+php-apcu
+php-fpm
+php-gd
+php-imagick
+php-legacy
+php-legacy-gd
+php-legacy-memcache
+php-legacy-memcached
+php-legacy-odbc
+php-legacy-redis
+php-legacy-sodium
+php-legacy-sqlite
+php-legacy-tidy
+php-redis
+php-sodium
+php-sqlite
+php-tidy
+powerline
+progress
+python-pip
+python-pipx
+rsync
+screen
+sshfs
+teamspeak3-server
+unace
+unarj
+unrar
+unzip
+zip